What the developer wrote
Authored by ziggie
kvdb: remove stale xz replace
Remove the nested kvdb module's github.com/ulikunitz/xz replace
directive.
The current kvdb module graph does not select github.com/ulikunitz/xz,
so the historical vulnerability workaround is no longer needed in this
nested go.mod.
What changed, and why it matters
This commit removes a temporary security workaround in a Go module file. The workaround forced the use of a newer, fixed version of a compression library (xz) to avoid a known historical vulnerability. The commit message says the library is no longer used by this part of the project, so the workaround is no longer needed. By itself, removing the workaround does not introduce a vulnerability, but it means the project now relies on the normal dependency resolution to pick a safe version elsewhere.
Verify that the root `go.mod` or other modules still pin or select a patched version of `github.com/ulikunitz/xz` (v0.5.11 or later) so the historical vulnerability is not reintroduced anywhere in the build graph. Run `go mod graph` and `go mod why` to confirm the package is no longer selected by kvdb.
Security signals we found
Removal of a dependency-level vulnerability workaround
Reference to historical advisory GHSA-25xm-hr59-7c27 in deleted comment
No code changes; only go.mod cleanup
Evidence from the diff
The change deletes a replace directive in kvdb/go.mod that pinned github.com/ulikunitz/xz to v0.5.11 (a patched version for GHSA-25xm-hr59-7c27). The commit message states the current kvdb module graph no longer selects this dependency, so the replace directive is stale. The diff is purely a build/dependency cleanup; no application code is modified.
Changed components
kvdb/go.modgithub.com/ulikunitz/xz dependency resolution in kvdb submoduleInspect captured patch +0 / −3
diff --git a/kvdb/go.mod b/kvdb/go.mod
index b23eb87..9345fcc 100644
--- a/kvdb/go.mod
+++ b/kvdb/go.mod
@@ -141,7 +141,4 @@ require (
sigs.k8s.io/yaml v1.2.0 // indirect
)
-// This replace is for https://github.com/advisories/GHSA-25xm-hr59-7c27
-replace github.com/ulikunitz/xz => github.com/ulikunitz/xz v0.5.11
-
go 1.25.11
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.